pulse-updates 1.3.4 → 1.3.5

package/android/src/main/java/app/pulse/updates/PulseController.kt

@@ -98,6 +98,8 @@ class PulseController private constructor() {
     private var directory: File? = null
     private var embeddedManifest: EmbeddedManifest? = null
     private val executor = Executors.newSingleThreadExecutor()
+    @Volatile
+    private var nativeSignatureTrustRoot: PulseSignatureTrustRoot? = null
 
     // Stable, anonymous per-install device id (persisted in the pulse dir). Lazily generated.
     // Used to (a) bucket staged rollouts server-side via the Pulse-Device-Id header and
@@ -209,6 +211,48 @@ class PulseController private constructor() {
 
     // MARK: - Public API
 
+    /**
+     * Load only the signing trust root needed by JS config/decision verification.
+     *
+     * Debug React Native hosts intentionally bypass getBundleFile() and obtain JS
+     * from Metro. That means the normal launch initializer has not run when JS asks
+     * the native module to verify a signed config response. Keep this path deliberately
+     * smaller than initializeWithoutStarting(): it must not open the update database,
+     * seed/select a bundle, mark a launch, or start update/error-recovery machinery.
+     */
+    @Synchronized
+    internal fun initializeSignatureTrustRoot(context: Context): PulseSignatureTrustRoot? {
+        config?.let { configured ->
+            // A partially supplied override is a configuration error. Do not quietly
+            // combine or replace one of its halves with values from another source.
+            if (configured.signingKeyId != null || configured.signingPublicKey != null) {
+                return PulseSignatureTrustRoot.from(
+                    configured.signingKeyId,
+                    configured.signingPublicKey
+                )
+            }
+        }
+        nativeSignatureTrustRoot?.let { return it }
+
+        val applicationContext = context.applicationContext
+        val loaded = try {
+            val appInfo = applicationContext.packageManager.getApplicationInfo(
+                applicationContext.packageName,
+                android.content.pm.PackageManager.GET_META_DATA
+            )
+            PulseSignatureTrustRoot.from(
+                appInfo.metaData?.getString("PulseUpdatesSigningKeyId"),
+                appInfo.metaData?.getString("PulseUpdatesSigningPublicKey")
+            )
+        } catch (error: Exception) {
+            pulseLogWarn(TAG, "Failed to load native signing trust root: ${error.message}")
+            null
+        }
+
+        nativeSignatureTrustRoot = loaded
+        return loaded
+    }
+
     /**
      * Initialize context and directory without full config
      * Called by getBundleFile before JS starts
@@ -1052,6 +1096,20 @@ data class PulseUpdatesConfig(
         }
 }
 
+/** Native-pinned Ed25519 verifier identity, intentionally separate from update launch config. */
+internal data class PulseSignatureTrustRoot(
+    val keyId: String,
+    val publicKey: String
+) {
+    companion object {
+        fun from(keyId: String?, publicKey: String?): PulseSignatureTrustRoot? {
+            val normalizedKeyId = keyId?.trim()?.takeIf { it.isNotEmpty() } ?: return null
+            val normalizedPublicKey = publicKey?.trim()?.takeIf { it.isNotEmpty() } ?: return null
+            return PulseSignatureTrustRoot(normalizedKeyId, normalizedPublicKey)
+        }
+    }
+}
+
 // MARK: - Results
 
 data class CheckResult(

package/android/src/main/java/app/pulse/updates/PulseUpdatesModule.kt

@@ -75,13 +75,16 @@ class PulseUpdatesModule(private val reactContext: ReactApplicationContext) :
 
     @ReactMethod
     fun verifySignatureAsync(canonicalPayload: String, alg: String, keyId: String, signature: String, promise: Promise) {
-        val config = PulseController.getInstance().config
-        if (alg.lowercase() != "ed25519" || config?.signingKeyId != keyId || config.signingPublicKey == null) {
+        // Metro/debug hosts do not enter getBundleFile(), so load the native-pinned
+        // trust root without starting OTA launch selection before verifying config.
+        val trustRoot = PulseController.getInstance()
+            .initializeSignatureTrustRoot(reactContext.applicationContext)
+        if (alg.lowercase() != "ed25519" || trustRoot?.keyId != keyId) {
             promise.resolve(false)
             return
         }
         try {
-            val publicKeyBytes = android.util.Base64.decode(config.signingPublicKey, android.util.Base64.DEFAULT)
+            val publicKeyBytes = android.util.Base64.decode(trustRoot.publicKey, android.util.Base64.DEFAULT)
             val signatureBytes = android.util.Base64.decode(signature, android.util.Base64.DEFAULT)
             val spec = net.i2p.crypto.eddsa.spec.EdDSANamedCurveTable.getByName("Ed25519")
             val publicKey = net.i2p.crypto.eddsa.EdDSAPublicKey(

package/ios/PulseUpdates/PulseController.swift

@@ -146,6 +146,11 @@ public final class PulseController {
     // Only valid for the immediate check->fetch sequence, cleared on use or new check
     private var lastCheckManifest: PulseManifestModel?
 
+    // JS config verification can run in a DEBUG/Metro host before bundle selection.
+    // Cache its native-pinned trust root independently from the launch lifecycle.
+    private let signatureTrustRootLock = NSLock()
+    private var nativeSignatureTrustRoot: PulseSignatureTrustRoot?
+
     // Flag to prevent concurrent fetch operations (with lock for thread safety)
     private var isFetching = false
     private var pendingFetchCallbacks: [(Result<PulseFetchResult, Error>) -> Void] = []
@@ -222,6 +227,45 @@ public final class PulseController {
 
     // MARK: - Public API
 
+    /// Load only the signing trust root needed by JS config/decision verification.
+    ///
+    /// DEBUG builds intentionally return nil from `getBundleURL()` so React Native
+    /// stays attached to Metro. This method therefore must not start Pulse, open its
+    /// database, seed/select a bundle, or install launch/error-recovery bookkeeping.
+    func initializeSignatureTrustRoot() -> PulseSignatureTrustRoot? {
+        if let configuredConfig = config,
+           (configuredConfig.signingKeyId != nil || configuredConfig.signingPublicKey != nil) {
+            // A partially supplied override is a configuration error. Do not quietly
+            // combine or replace one of its halves with values from another source.
+            return PulseSignatureTrustRoot(
+                keyId: configuredConfig.signingKeyId,
+                publicKey: configuredConfig.signingPublicKey
+            )
+        }
+
+        signatureTrustRootLock.lock()
+        defer { signatureTrustRootLock.unlock() }
+
+        if let configuredConfig = config,
+           (configuredConfig.signingKeyId != nil || configuredConfig.signingPublicKey != nil) {
+            return PulseSignatureTrustRoot(
+                keyId: configuredConfig.signingKeyId,
+                publicKey: configuredConfig.signingPublicKey
+            )
+        }
+        if let cached = nativeSignatureTrustRoot {
+            return cached
+        }
+
+        let info = Bundle.main.infoDictionary
+        let loaded = PulseSignatureTrustRoot(
+            keyId: info?["PulseUpdatesSigningKeyId"] as? String,
+            publicKey: info?["PulseUpdatesSigningPublicKey"] as? String
+        )
+        nativeSignatureTrustRoot = loaded
+        return loaded
+    }
+
     /// Configure the controller (call before start)
     public func configure(_ config: PulseUpdatesConfig) {
         self.config = config

package/ios/PulseUpdates/PulseTypes.swift

@@ -56,6 +56,23 @@ public struct PulseUpdatesConfig {
     }
 }
 
+/// Native-pinned Ed25519 verifier identity, separate from update launch state.
+struct PulseSignatureTrustRoot {
+    let keyId: String
+    let publicKey: String
+
+    init?(keyId: String?, publicKey: String?) {
+        guard let keyId = keyId?.trimmingCharacters(in: .whitespacesAndNewlines),
+              !keyId.isEmpty,
+              let publicKey = publicKey?.trimmingCharacters(in: .whitespacesAndNewlines),
+              !publicKey.isEmpty else {
+            return nil
+        }
+        self.keyId = keyId
+        self.publicKey = publicKey
+    }
+}
+
 // MARK: - Manifest Models
 
 public struct PulseManifestModel: Codable {

package/ios/PulseUpdates/PulseUpdates.swift

@@ -69,11 +69,12 @@ public class PulseUpdates: RCTEventEmitter {
                               signature: String,
                               resolve: @escaping RCTPromiseResolveBlock,
                               reject: @escaping RCTPromiseRejectBlock) {
+        // DEBUG/Metro bypasses getBundleURL(), so obtain only the native-pinned
+        // trust root here without entering update database or bundle selection.
         guard alg.lowercased() == "ed25519",
-              let config = PulseController.shared.config,
-              config.signingKeyId == keyId,
-              let keyBase64 = config.signingPublicKey,
-              let keyData = Data(base64Encoded: keyBase64),
+              let trustRoot = PulseController.shared.initializeSignatureTrustRoot(),
+              trustRoot.keyId == keyId,
+              let keyData = Data(base64Encoded: trustRoot.publicKey),
               let signatureData = Data(base64Encoded: signature),
               let payloadData = canonicalPayload.data(using: .utf8),
               let publicKey = try? Curve25519.Signing.PublicKey(rawRepresentation: keyData) else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pulse-updates",
-  "version": "1.3.4",
+  "version": "1.3.5",
   "description": "Pulse app-experience SDK for React Native: updates, config, experiments, events, decisions and first-party links",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",